Support

The Bad Behavior feature is an integration of the same-named third party library which tries to analyse the inbound HTTP traffic to your site and figure out potential spammer, cracker or spambot attacks. It does cause some overhead, as each inbound request has to be analysed by the library.

Providing a PH:BL key will allow your site to determine if a visitor is a known hacker or spammer and deny him access to your site. In order to do that, a DNS query has to be performed on each inbound request. Most likely your host does cache these DNS queries' results so there is minimal overhead.

Unless you have a very serious spammer issue on your site, I'd suggest turning the Bad Behavior feature off.

Actually, yes. Bad Behavior by itself uses a heuristics system to analyse the inbound request. HTTP:BL, on the other hand, checks the IP address of the inbound request against a global database of known attackers. The idea is that if someone is on the black list, we shouldn't bother serving his request at all. So, the workflow is: check the HTTP:BL database using a DNS query, if the IP address shows a known attacker immediately deny the request, otherwise proceed with the heuristics. IMHO, if you're going to be using Bad Behavior integration it's worth the overhead.